Windows: Detect OneNote Temp File Creation with Suspicious Executable Extensions

Alerts when OneNote creates files in Temp\OneNote with script/executable extensions on Windows.

FreeUnreviewedSigmahighv1

windows-detect-onenote-temp-file-creation-with-suspicious-executable-extensions-fcc6d700

title: "Windows: Detect OneNote Temp File Creation with Suspicious Executable Extensions"
id: dbcf8862-e0f3-4bb5-8394-eb2e14519011
status: test
description: This rule flags file creation events where the process is OneNote-related and the target path is under AppData\Local\Temp\OneNote\, with the created filename containing common script or executable extensions (e.g., .exe, .dll, .js, .vbs, .ps1). Attackers may abuse OneNote to stage and deliver payloads through files written to temporary OneNote storage before execution or follow-on activity. It relies on Windows file event telemetry that records the creating process image and the target filename/path.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://twitter.com/MaD_c4t/status/1623414582382567424
  - https://labs.withsecure.com/publications/detecting-onenote-abuse
  - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/
  - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-09
modified: 2023-02-27
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \onenote.exe
      - \onenotem.exe
      - \onenoteim.exe
    TargetFilename|contains: \AppData\Local\Temp\OneNote\
    TargetFilename|endswith:
      - .bat
      - .chm
      - .cmd
      - .dll
      - .exe
      - .hta
      - .htm
      - .html
      - .js
      - .lnk
      - .ps1
      - .vbe
      - .vbs
      - .wsf
  condition: selection
falsepositives:
  - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote.
  - Occasional FPs might occur if OneNote is used internally to share different embedded documents
level: high
license: DRL-1.1
related:
  - id: fcc6d700-68d9-4241-9a1a-06874d621b06
    type: derived

What it detects

This rule flags file creation events where the process is OneNote-related and the target path is under AppData\Local\Temp\OneNote\, with the created filename containing common script or executable extensions (e.g., .exe, .dll, .js, .vbs, .ps1). Attackers may abuse OneNote to stage and deliver payloads through files written to temporary OneNote storage before execution or follow-on activity. It relies on Windows file event telemetry that records the creating process image and the target filename/path.

Known false positives

False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote.
Occasional FPs might occur if OneNote is used internally to share different embedded documents

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.